c117d9ca536f1be04ad79f2964b5e01cc46841f27fd88c3784032e3a426f4cfc

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 18:05

Target

c117d9ca536f1be04ad79f2964b5e01cc46841f27fd88c3784032e3a426f4cfc.dll
Size

51KB
MD5

78ee76df4886adf4e5a9a9f761f2303e
SHA1

4088665a122d9cb6ca8dc221c8898a5c4d2e5eb7
SHA256

c117d9ca536f1be04ad79f2964b5e01cc46841f27fd88c3784032e3a426f4cfc
SHA512

50470191dbc91ca02b4381103fbd73b0f0903ada78c950f6c4aff8c6e99f0505074acbf198fdcffa9d8476a4af61ea362b8183c3b708efa096523647e87b5d02
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLCJYH5:1dWubF3n9S91BF3fbouJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3836	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3836	1884	rundll32.exe	85
PID 1884 wrote to memory of 3836	1884	rundll32.exe	85
PID 1884 wrote to memory of 3836	1884	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c117d9ca536f1be04ad79f2964b5e01cc46841f27fd88c3784032e3a426f4cfc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c117d9ca536f1be04ad79f2964b5e01cc46841f27fd88c3784032e3a426f4cfc.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3836